ShockVPN/shockbot
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: replace narrow parameter types with context objects (#519)

Browse Source 
* refactor: replace narrow parameter types with context objects across action/

pass broader context objects (ToolContext, PromptContext, PostCleanupContext) to
utility functions instead of cherry-picking fields into single-use interfaces.
deletes 8 narrow types, simplifies call sites, and makes buildCommentFooter
synchronous by reading ctx.runId/ctx.jobId directly instead of re-deriving
from env vars and making an extra API call.

Made-with: Cursor

* fix: replace non-null assertion with local guard in validatePushDestination

addresses review feedback — the function now validates pushUrl itself instead
of relying on the caller's check, eliminating the ! assertion.

Made-with: Cursor

* revert: remove GH_TOKEN injection from restricted shell

the original change exposed the git token in restricted-mode shell so
`gh` CLI would work. this is a security regression for public repos: MCP
tools are deliberately constrained (no merge, no release, no arbitrary
API calls), but `gh api` with the token gives full GitHub API access to
any prompt-injected agent.

Made-with: Cursor
This commit is contained in:
Colin McDonnell
2026-04-04 20:51:49 +00:00
committed by pullfrog[bot]
parent ab76a4ad04
commit 2ea447a780
9 changed files with 5652 additions and 5829 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mcp/checkout.test.ts
+12 -8
View File
@@ -1,7 +1,8 @@
import { Octokit } from "@octokit/rest";
import type { RestEndpointMethodTypes } from "@octokit/rest";
import { describe, expect, it } from "vitest";
import { acquireNewToken } from "../utils/github.ts";
import { acquireNewToken, createOctokit } from "../utils/github.ts";
import { fetchAndFormatPrDiff } from "./checkout.ts";
import type { ToolContext } from "./server.ts";
/**
* parses TOC entries like "- src/math.ts → lines 7-42" into structured data.
@@ -33,13 +34,16 @@ describe("fetchAndFormatPrDiff", () => {
{ timeout: 30000 },
async () => {
const token = await getToken();
const octokit = new Octokit({ auth: token });
const result = await fetchAndFormatPrDiff({
const octokit = createOctokit(token);
const ctx = {
octokit,
owner: "pullfrog",
repo: "test-repo",
pullNumber: 1,
});
repo: {
owner: "pullfrog",
name: "test-repo",
data: {} as RestEndpointMethodTypes["repos"]["get"]["response"]["data"],
},
} as ToolContext;
const result = await fetchAndFormatPrDiff(ctx, 1);
// verify content includes TOC at the start
expect(result.content.startsWith(result.toc)).toBe(true);
mcp/checkout.ts
+9 -18
View File
@@ -145,22 +145,18 @@ export type CheckoutPrResult = {
instructions: string;
};
type FetchPrDiffParams = {
octokit: Octokit;
owner: string;
repo: string;
pullNumber: number;
};
/**
* fetches PR files from GitHub and formats them with line numbers and TOC.
* this is the core diff formatting logic, extracted for testability.
*/
export async function fetchAndFormatPrDiff(params: FetchPrDiffParams): Promise<FormatFilesResult> {
const files = await params.octokit.paginate(params.octokit.rest.pulls.listFiles, {
owner: params.owner,
repo: params.repo,
pull_number: params.pullNumber,
export async function fetchAndFormatPrDiff(
ctx: ToolContext,
pullNumber: number
): Promise<FormatFilesResult> {
const files = await ctx.octokit.paginate(ctx.octokit.rest.pulls.listFiles, {
owner: ctx.repo.owner,
repo: ctx.repo.name,
pull_number: pullNumber,
per_page: 100,
});
return formatFilesWithLineNumbers(files);
@@ -502,12 +498,7 @@ export function CheckoutPrTool(ctx: ToolContext) {
}
// fetch PR files and format with line numbers
const formatResult = await fetchAndFormatPrDiff({
octokit: ctx.octokit,
owner: ctx.repo.owner,
repo: ctx.repo.name,
pullNumber: pull_number,
});
const formatResult = await fetchAndFormatPrDiff(ctx, pull_number);
const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
log.debug(`formatted diff preview (first 100 lines):\n${diffPreview}`);
const diffPath = join(tempDir, `pr-${pull_number}-${headShort}.diff`);
mcp/comment.ts
+27 -70
View File
@@ -4,7 +4,6 @@ import { getApiUrl } from "../utils/apiUrl.ts";
import { buildPullfrogFooter, stripExistingFooter } from "../utils/buildPullfrogFooter.ts";
import { log } from "../utils/cli.ts";
import { fixDoubleEscapedString } from "../utils/fixDoubleEscapedString.ts";
import { type OctokitWithPlugins, parseRepoContext } from "../utils/github.ts";
import { retry } from "../utils/retry.ts";
import type { ToolContext } from "./server.ts";
import { execute, tool } from "./shared.ts";
@@ -52,65 +51,37 @@ export async function updateCommentNodeId(
*/
export const LEAPING_INTO_ACTION_PREFIX = "Leaping into action";
interface BuildCommentFooterParams {
octokit?: OctokitWithPlugins | undefined;
customParts?: string[] | undefined;
model?: string | undefined;
}
async function buildCommentFooter(params: BuildCommentFooterParams): Promise<string> {
const repoContext = parseRepoContext();
const runId = process.env.GITHUB_RUN_ID
? Number.parseInt(process.env.GITHUB_RUN_ID, 10)
: undefined;
let jobId: string | undefined;
if (runId && params.octokit) {
try {
const { data: jobs } = await params.octokit.rest.actions.listJobsForWorkflowRun({
owner: repoContext.owner,
repo: repoContext.name,
run_id: runId,
});
jobId = jobs.jobs[0]?.id.toString();
} catch {
// fall back to computed URL from runId alone
}
}
function buildCommentFooter(ctx: ToolContext, customParts?: string[]): string {
const runId = ctx.runId;
return buildPullfrogFooter({
triggeredBy: true,
workflowRun: runId
? { owner: repoContext.owner, repo: repoContext.name, runId, jobId }
: undefined,
customParts: params.customParts,
model: params.model,
workflowRun:
runId !== undefined
? {
owner: ctx.repo.owner,
repo: ctx.repo.name,
runId,
jobId: ctx.jobId,
}
: undefined,
customParts,
model: ctx.toolState.model,
});
}
function buildImplementPlanLink(
owner: string,
repo: string,
issueNumber: number,
commentId: number
): string {
function buildImplementPlanLink(ctx: ToolContext, issueNumber: number, commentId: number): string {
const apiUrl = getApiUrl();
return `[Implement plan ➔](${apiUrl}/trigger/${owner}/${repo}/${issueNumber}?action=implement&comment_id=${commentId})`;
return `[Implement plan ➔](${apiUrl}/trigger/${ctx.repo.owner}/${ctx.repo.name}/${issueNumber}?action=implement&comment_id=${commentId})`;
}
export interface AddFooterCtx {
octokit?: OctokitWithPlugins | undefined;
toolState?: { model?: string | undefined } | undefined;
}
export async function addFooter(ctx: AddFooterCtx, body: string): Promise<string> {
export function addFooter(ctx: ToolContext, body: string): string {
if (/<br\s*\/?>[ \t]*\n(?!\s*\n)/i.test(body)) {
throw new Error(
"body contains <br/> followed by a non-blank line, which breaks GitHub markdown rendering. always add a blank line after <br/> tags."
);
}
const bodyWithoutFooter = stripExistingFooter(fixDoubleEscapedString(body));
const footer = await buildCommentFooter({ octokit: ctx.octokit, model: ctx.toolState?.model });
const footer = buildCommentFooter(ctx);
return `${bodyWithoutFooter}${footer}`;
}
@@ -132,7 +103,7 @@ export function CreateCommentTool(ctx: ToolContext) {
"Create a comment on a GitHub issue or PR. For progress/plan updates on the current run use report_progress instead. Use type: 'Plan' for plan comments, type: 'Summary' for PR summary comments.",
parameters: Comment,
execute: execute(async ({ issueNumber, body, type: commentType }) => {
const bodyWithFooter = await addFooter(ctx, body);
const bodyWithFooter = addFooter(ctx, body);
// if a summary comment already exists (found by select_mode), update instead of creating
if (commentType === "Summary" && ctx.toolState.existingSummaryCommentId) {
@@ -193,7 +164,7 @@ export function EditCommentTool(ctx: ToolContext) {
description: "Edit a GitHub issue comment by its ID",
parameters: EditComment,
execute: execute(async ({ commentId, body }) => {
const bodyWithFooter = await addFooter(ctx, body);
const bodyWithFooter = addFooter(ctx, body);
const result = await ctx.octokit.rest.issues.updateComment({
owner: ctx.repo.owner,
@@ -260,14 +231,10 @@ export async function reportProgress(
const commentId = ctx.toolState.existingPlanCommentId;
const customParts =
isPlanMode && issueNumber !== undefined
? [buildImplementPlanLink(ctx.repo.owner, ctx.repo.name, issueNumber, commentId)]
? [buildImplementPlanLink(ctx, issueNumber, commentId)]
: undefined;
const bodyWithoutFooter = stripExistingFooter(body);
const footer = await buildCommentFooter({
octokit: ctx.octokit,
customParts,
model: ctx.toolState.model,
});
const footer = buildCommentFooter(ctx, customParts);
const bodyWithFooter = `${bodyWithoutFooter}${footer}`;
const result = await ctx.octokit.rest.issues.updateComment({
@@ -297,15 +264,11 @@ export async function reportProgress(
if (existingCommentId) {
const customParts =
isPlanMode && issueNumber !== undefined
? [buildImplementPlanLink(ctx.repo.owner, ctx.repo.name, issueNumber, existingCommentId)]
? [buildImplementPlanLink(ctx, issueNumber, existingCommentId)]
: undefined;
const bodyWithoutFooter = stripExistingFooter(body);
const footer = await buildCommentFooter({
octokit: ctx.octokit,
customParts,
model: ctx.toolState.model,
});
const footer = buildCommentFooter(ctx, customParts);
const bodyWithFooter = `${bodyWithoutFooter}${footer}`;
const result = await ctx.octokit.rest.issues.updateComment({
@@ -343,7 +306,7 @@ export async function reportProgress(
}
// for new comments, we need to create first, then update with Plan link if in Plan mode
const initialBody = await addFooter(ctx, body);
const initialBody = addFooter(ctx, body);
const result = await ctx.octokit.rest.issues.createComment({
owner: ctx.repo.owner,
@@ -358,15 +321,9 @@ export async function reportProgress(
// if Plan mode, update the comment to add the "Implement plan" link
if (isPlanMode) {
const customParts = [
buildImplementPlanLink(ctx.repo.owner, ctx.repo.name, issueNumber, result.data.id),
];
const customParts = [buildImplementPlanLink(ctx, issueNumber, result.data.id)];
const bodyWithoutFooter = stripExistingFooter(body);
const footer = await buildCommentFooter({
octokit: ctx.octokit,
customParts,
model: ctx.toolState.model,
});
const footer = buildCommentFooter(ctx, customParts);
const bodyWithPlanLink = `${bodyWithoutFooter}${footer}`;
const updateResult = await ctx.octokit.rest.issues.updateComment({
@@ -490,7 +447,7 @@ export function ReplyToReviewCommentTool(ctx: ToolContext) {
"Reply to a PR review comment thread (NOT issue comments — this only works for inline review comments on PR diffs). Call this for EACH comment you address in AddressReviews mode. Keep replies extremely brief (1 sentence max).",
parameters: ReplyToReviewComment,
execute: execute(async ({ pull_number, comment_id, body }) => {
const bodyWithFooter = await addFooter(ctx, body);
const bodyWithFooter = addFooter(ctx, body);
const result = await ctx.octokit.rest.pulls.createReplyForReviewComment({
owner: ctx.repo.owner,
mcp/git.ts
+8 -19
View File
@@ -57,23 +57,20 @@ function normalizeUrl(url: string): string {
return url.replace(/\.git$/, "").toLowerCase();
}
type ValidatePushParams = {
branch: string;
pushUrl: string;
storedDest: StoredPushDest | undefined;
};
/**
* validate that the push destination matches expected URL.
* pushUrl is set by setupGit (base repo) and updated by checkout_pr (fork repo).
*/
function validatePushDestination(params: ValidatePushParams): PushDestination {
const dest = getPushDestination(params.branch, params.storedDest);
function validatePushDestination(ctx: ToolContext, branch: string): PushDestination {
const pushUrl = ctx.toolState.pushUrl;
if (!pushUrl) throw new Error("pushUrl not set - setupGit must run before push_branch");
if (normalizeUrl(dest.url) !== normalizeUrl(params.pushUrl)) {
const dest = getPushDestination(branch, ctx.toolState.pushDest);
if (normalizeUrl(dest.url) !== normalizeUrl(pushUrl)) {
throw new Error(
`Push blocked: destination does not match expected repository.\n` +
`Expected: ${params.pushUrl}\n` +
`Expected: ${pushUrl}\n` +
`Actual: ${dest.url}\n` +
`Git configuration may have been tampered with.`
);
@@ -119,15 +116,7 @@ export function PushBranchTool(ctx: ToolContext) {
}
// validate push destination matches expected URL
const pushUrl = ctx.toolState.pushUrl;
if (!pushUrl) {
throw new Error("pushUrl not set - setupGit must run before push_branch");
}
const pushDest = validatePushDestination({
branch,
pushUrl,
storedDest: ctx.toolState.pushDest,
});
const pushDest = validatePushDestination(ctx, branch);
// block pushes to default branch in restricted mode
if (pushPermission === "restricted" && pushDest.remoteBranch === defaultBranch) {
mcp/selectMode.ts
+10 -19
View File
@@ -65,15 +65,14 @@ const modeInstructionParent: Record<string, string> = {
Fix: "Build",
};
type BuildGuidanceOpts = {
modeInstructions?: Record<string, string>;
overrideGuidance?: string;
};
function buildOrchestratorGuidance(mode: Mode, opts: BuildGuidanceOpts = {}): OrchestratorGuidance {
const hardcoded = opts.overrideGuidance ?? mode.prompt ?? "";
function buildOrchestratorGuidance(
ctx: ToolContext,
mode: Mode,
overrideGuidance?: string
): OrchestratorGuidance {
const hardcoded = overrideGuidance ?? mode.prompt ?? "";
const lookupKey = modeInstructionParent[mode.name] ?? mode.name;
const userInstructions = opts.modeInstructions?.[lookupKey] ?? "";
const userInstructions = ctx.modeInstructions[lookupKey] ?? "";
const guidance = [hardcoded, userInstructions].filter(Boolean).join("\n\n");
return {
modeName: mode.name,
@@ -172,8 +171,6 @@ export function SelectModeTool(ctx: ToolContext) {
ctx.toolState.selectedMode = selectedMode.name;
const guidanceOpts: BuildGuidanceOpts = { modeInstructions: ctx.modeInstructions };
if (selectedMode.name === "Plan") {
const issueNumber = params.issue_number ?? ctx.payload.event.issue_number;
if (issueNumber !== undefined) {
@@ -182,10 +179,7 @@ export function SelectModeTool(ctx: ToolContext) {
ctx.toolState.existingPlanCommentId = existing.commentId;
ctx.toolState.previousPlanBody = existing.body;
return {
...buildOrchestratorGuidance(selectedMode, {
...guidanceOpts,
overrideGuidance: overrides.PlanEdit,
}),
...buildOrchestratorGuidance(ctx, selectedMode, overrides.PlanEdit),
previousPlanBody: existing.body,
};
}
@@ -199,10 +193,7 @@ export function SelectModeTool(ctx: ToolContext) {
if (existing !== null) {
ctx.toolState.existingSummaryCommentId = existing.commentId;
return {
...buildOrchestratorGuidance(selectedMode, {
...guidanceOpts,
overrideGuidance: overrides.SummaryUpdate,
}),
...buildOrchestratorGuidance(ctx, selectedMode, overrides.SummaryUpdate),
existingSummaryCommentId: existing.commentId,
previousSummaryBody: existing.body,
};
@@ -210,7 +201,7 @@ export function SelectModeTool(ctx: ToolContext) {
}
}
return buildOrchestratorGuidance(selectedMode, guidanceOpts);
return buildOrchestratorGuidance(ctx, selectedMode);
}),
});
}